Add SeCreateSymbolicLinkPrivilege (#4649) (#4650)

mergify[bot] · blakerouse · web-flow · commit 6567a0837201 · 2024-05-02T10:00:18.000-04:00
(cherry picked from commit 5fe8deb) Co-authored-by: Blake Rouse <blake.rouse@elastic.co>
diff --git a/internal/pkg/agent/install/user_windows.go b/internal/pkg/agent/install/user_windows.go
@@ -39,6 +39,8 @@ const (
 	USER_UF_SCRIPT             = 1
 	USER_UF_NORMAL_ACCOUNT     = 512
 	USER_UF_DONT_EXPIRE_PASSWD = 65536
+
+	accountRightCreateSymbolicLink gowin32.AccountRightName = "SeCreateSymbolicLinkPrivilege"
 )
 
 // FindGID returns the group's GID on the machine.
@@ -151,6 +153,10 @@ func CreateUser(name string, _ string) (string, error) {
 	if err != nil {
 		return "", fmt.Errorf("failed to set service logon: %w", err)
 	}
+	err = sp.AddAccountRight(sid, accountRightCreateSymbolicLink)
+	if err != nil {
+		return "", fmt.Errorf("failed to add right to create symbolic link: %w", err)
+	}
 
 	return FindUID(name)
 }

Original file line number	Diff line number	Diff line change
`@@ -39,6 +39,8 @@ const (`
`39`	`39`	`USER_UF_SCRIPT = 1`
`40`	`40`	`USER_UF_NORMAL_ACCOUNT = 512`
`41`	`41`	`USER_UF_DONT_EXPIRE_PASSWD = 65536`
	`42`	`+`
	`43`	`+ accountRightCreateSymbolicLink gowin32.AccountRightName = "SeCreateSymbolicLinkPrivilege"`
`42`	`44`	`)`
`43`	`45`
`44`	`46`	`// FindGID returns the group's GID on the machine.`
`@@ -151,6 +153,10 @@ func CreateUser(name string, _ string) (string, error) {`
`151`	`153`	`if err != nil {`
`152`	`154`	`return "", fmt.Errorf("failed to set service logon: %w", err)`
`153`	`155`	`}`
	`156`	`+ err = sp.AddAccountRight(sid, accountRightCreateSymbolicLink)`
	`157`	`+ if err != nil {`
	`158`	`+ return "", fmt.Errorf("failed to add right to create symbolic link: %w", err)`
	`159`	`+ }`
`154`	`160`
`155`	`161`	`return FindUID(name)`
`156`	`162`	`}`